@camstack/server 1.2.483 → 1.2.485

package/.env.example

@@ -1,13 +1,9 @@
 # CamStack Server Environment
 # Copy to .env and customize. Loaded via Node.js --env-file flag.
 
-# Fixed JWT secret (prevents token invalidation on server restart)
-# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
-CAMSTACK_JWT_SECRET=
-
-# Admin credentials
-CAMSTACK_ADMIN_USER=admin
-CAMSTACK_ADMIN_PASS=changeme
+# No secret is configured through the environment (D797): the session signing
+# key and the cluster secret live in the hub's keychain, and a fresh hub seeds
+# the admin account admin / changeme (the first sign-in forces a change).
 
 # Data directory (default: camstack-data)
 # CAMSTACK_DATA=camstack-data

package/dist/agent/agent-config.js

@@ -73,7 +73,8 @@ function ensurePersistedNodeId(configPath, dataDir) {
     raw.nodeId = id;
     try {
         fs.mkdirSync(path.dirname(resolvedPath), { recursive: true });
-        fs.writeFileSync(resolvedPath, JSON.stringify(raw, null, 2), 'utf-8');
+        // 0600: the same file holds the cluster secret.
+        fs.writeFileSync(resolvedPath, JSON.stringify(raw, null, 2), { encoding: 'utf-8', mode: 0o600 });
     }
     catch {
         /* best-effort */
@@ -89,9 +90,10 @@ function loadAgentConfig(configPath, dataDirOverride) {
     const envName = process.env.CAMSTACK_NODE_ID ??
         process.env.CAMSTACK_AGENT_NAME ??
         `${os.hostname()}-${os.arch()}`;
-    // Environment variables for hub connection (optional — agent starts without)
+    // Environment variable for the hub connection (optional — agent starts
+    // without). The cluster secret is NOT one of them (D797): it lives only in
+    // agent.json.
     const envHubAddress = process.env.CAMSTACK_HUB_ADDRESS || undefined;
-    const envSecret = process.env.CAMSTACK_CLUSTER_SECRET || undefined;
     const configFullPath = path.resolve(resolvedDataDir, filePath);
     const nodeId = ensurePersistedNodeId(filePath, resolvedDataDir);
     // Read persisted config — these override env vars
@@ -112,7 +114,7 @@ function loadAgentConfig(configPath, dataDirOverride) {
     // Config file wins over env for all user-editable fields
     const effectiveName = fileName ?? envName;
     const effectiveHub = fileHubAddress ?? envHubAddress;
-    const effectiveSecret = fileSecret ?? envSecret;
+    const effectiveSecret = fileSecret;
     return {
         nodeId,
         name: effectiveName,

package/dist/agent/agent-http.js

@@ -151,9 +151,11 @@ function readConfigFile(configPath) {
         return {};
     }
 }
+/** agent.json holds the cluster secret (D797): always 0600. */
 function writeConfigFile(configPath, data) {
     fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    fs.writeFileSync(configPath, JSON.stringify(data, null, 2), 'utf-8');
+    fs.writeFileSync(configPath, JSON.stringify(data, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    fs.chmodSync(configPath, 0o600);
 }
 /** Live Moleculer registry snapshot — reused by agent-bootstrap's Option A. */
 function getRegistryNodes(broker) {

package/dist/agent/main.js

@@ -149,7 +149,6 @@ async function startAgent(configPath) {
         mode: 'agent',
         hubAddress: config.hubAddress,
         logLevel: config.logLevel,
-        secret: config.secret,
     });
     /**
      * Reconnect: stop the current broker, reload config from file,
@@ -184,7 +183,6 @@ async function startAgent(configPath) {
             mode: 'agent',
             hubAddress: fresh.hubAddress,
             logLevel: fresh.logLevel,
-            secret: fresh.secret,
         });
         await broker.start();
         console.log('[Agent] Reconnected successfully');
@@ -327,7 +325,7 @@ async function startAgent(configPath) {
         })
             .catch((err) => {
             if ((0, system_1.isClusterSecretMismatchError)(err)) {
-                consoleLogger.error('hub registration rejected: cluster secret mismatch — correct CAMSTACK_CLUSTER_SECRET and restart the agent');
+                consoleLogger.error('hub registration rejected: cluster secret mismatch — enter the hub\'s cluster secret (System → Cluster) in this agent\'s setup (agent.json) and restart the agent');
                 // Surface the mismatch in the UI status.
                 hubConnectionStateOverride = 'secret-mismatch';
                 return;

package/dist/api/trpc/generated-cap-routers.js

@@ -4522,6 +4522,15 @@ function createCapRouter_keychainAdmin(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.reveal(methodInput);
         }),
+        setSystemSecret: trpc_middleware_js_1.adminProcedure
+            .input(types_62.keychainAdminCapability.methods.setSystemSecret.input.loose())
+            .output(types_62.keychainAdminCapability.methods.setSystemSecret.output)
+            .mutation(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('keychain-admin', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.setSystemSecret(methodInput);
+        }),
         deleteOrphans: trpc_middleware_js_1.adminProcedure
             .input(types_62.keychainAdminCapability.methods.deleteOrphans.input.loose())
             .output(types_62.keychainAdminCapability.methods.deleteOrphans.output)

package/dist/api/trpc/trpc.context.js

@@ -282,8 +282,11 @@ function makeDeviceScopeLookup(addonRegistry) {
  * Context factory for hub-internal calls originating from the trusted
  * Moleculer mesh (the `$core-caps` bridge service in `core-cap-bridge.ts`).
  *
- * Cluster membership is gated by `CAMSTACK_CLUSTER_SECRET`, so a
- * mesh-originated call is treated as a fully-trusted admin: it carries
+ * A mesh-originated call is treated as a fully-trusted admin. NOTE (D797):
+ * the cluster secret (System → Cluster) gates `$hub.registerNode` only — the
+ * Moleculer TCP transport itself authenticates no peer, so anything that can
+ * reach the hub's mesh port can call this. Keep that port off untrusted
+ * networks; transport-level peer authentication is on the roadmap. It carries
  * a synthetic `isAdmin` user, which makes `protectedProcedure` /
  * `adminProcedure` pass without a JWT and skips the scope-access
  * matcher entirely. There is no HTTP request behind the call.

package/dist/boot/boot-config.js

@@ -39,10 +39,9 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ignoredTlsCertSources = ignoredTlsCertSources;
+exports.retiredSecretSources = retiredSecretSources;
 exports.loadBootstrapConfig = loadBootstrapConfig;
-exports.autoGenerateJwtSecret = autoGenerateJwtSecret;
 exports.setupInfra = setupInfra;
-const node_crypto_1 = require("node:crypto");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const types_1 = require("@camstack/types");
@@ -54,21 +53,34 @@ const storage_location_manager_1 = require("../core/storage/storage-location-man
 // ---------------------------------------------------------------------------
 const CONFIG_DEFAULTS = {
     server: { port: 4443, host: '0.0.0.0', dataPath: 'camstack-data' },
-    auth: {
-        jwtSecret: null,
-        adminUsername: 'admin',
-        adminPassword: 'changeme',
-    },
 };
+/**
+ * Bootstrap env overrides. No SECRET is among them (D783, D797): the session
+ * signing key and the cluster secret live in the keychain, and the first-boot
+ * admin is fixed (`admin` / `changeme`).
+ */
 const ENV_VAR_MAP = {
     CAMSTACK_PORT: 'server.port',
     CAMSTACK_HOST: 'server.host',
     CAMSTACK_DATA: 'server.dataPath',
-    CAMSTACK_JWT_SECRET: 'auth.jwtSecret',
-    CAMSTACK_ADMIN_USER: 'auth.adminUsername',
-    CAMSTACK_ADMIN_PASS: 'auth.adminPassword',
     CAMSTACK_TLS_ENABLED: 'tls.enabled',
 };
+/**
+ * Env variables that once carried a secret into the hub. Ignored since D797 —
+ * still named so a container template that sets them is told, not silently
+ * obeyed or silently dropped. Only their PRESENCE is read, never the value.
+ */
+const RETIRED_SECRET_ENV = [
+    'CAMSTACK_JWT_SECRET',
+    'CAMSTACK_ADMIN_USER',
+    'CAMSTACK_ADMIN_PASS',
+    'CAMSTACK_CLUSTER_SECRET',
+    'CAMSTACK_SECRET_KEY',
+    'HF_TOKEN',
+    'HUGGING_FACE_HUB_TOKEN',
+];
+/** `config.yaml` `auth.*` keys that once held a credential — ignored too (D797). */
+const RETIRED_AUTH_KEYS = ['jwtSecret', 'adminUsername', 'adminPassword'];
 /**
  * Env variables that once set the node's certificate. Ignored since D726:
  * the admin UI (Network → Local access) is the one way to set it. Still
@@ -103,6 +115,19 @@ function ignoredTlsCertSources(env, raw) {
     const fromYaml = IGNORED_TLS_CERT_KEYS.filter((key) => tls[key] !== undefined).map((key) => `tls.${key}`);
     return [...fromEnv, ...fromYaml];
 }
+/**
+ * Every retired secret source still present: env variables set (non-blank) and
+ * `config.yaml` `auth.*` keys. Names only — a value is never read into a log.
+ */
+function retiredSecretSources(env, raw) {
+    const fromEnv = RETIRED_SECRET_ENV.filter((name) => {
+        const value = env[name];
+        return value !== undefined && value !== '';
+    });
+    const auth = (0, types_1.asJsonObject)(raw['auth']) ?? {};
+    const fromYaml = RETIRED_AUTH_KEYS.filter((key) => auth[key] !== undefined && auth[key] !== null).map((key) => `auth.${key}`);
+    return [...fromEnv, ...fromYaml];
+}
 // ---------------------------------------------------------------------------
 // loadBootstrapConfig
 // ---------------------------------------------------------------------------
@@ -166,6 +191,13 @@ function loadBootstrapConfig(configPath) {
         raw = setNested(raw, configPath_, coerced);
         console.log(`[Phase1] Env override: ${envKey} → ${configPath_}`);
     }
+    const retired = retiredSecretSources(process.env, raw);
+    if (retired.length > 0) {
+        console.warn(`[Phase1] WARN ${retired.join(', ')} ignored — no secret is read from the environment or ` +
+            'config.yaml any more (D797). The session signing key and the cluster secret live in the ' +
+            'keychain (System → Cluster for the cluster secret); a fresh hub seeds admin / changeme. ' +
+            'Remove these entries — after importing their values with scripts/ops/keychain-migrate-hub.mjs.');
+    }
     const ignored = ignoredTlsCertSources(process.env, raw);
     if (ignored.length > 0) {
         console.warn(`[Phase1] WARN ${ignored.join(', ')} ignored — the certificate is set only in the admin UI. ` +
@@ -174,48 +206,16 @@ function loadBootstrapConfig(configPath) {
     return config_schema_1.bootstrapSchema.parse(raw);
 }
 // ---------------------------------------------------------------------------
-// autoGenerateJwtSecret
-// ---------------------------------------------------------------------------
-/**
- * If `jwtSecret` is null in the parsed config, generate a random secret,
- * persist it to the YAML file, and return an updated config.
- */
-function autoGenerateJwtSecret(configPath, bootstrapConfig) {
-    if (bootstrapConfig.auth.jwtSecret !== null) {
-        return bootstrapConfig;
-    }
-    const secret = (0, node_crypto_1.randomBytes)(32).toString('hex');
-    console.log('[Phase1] jwtSecret is null — auto-generating and writing to config.yaml');
-    let raw = {};
-    if (fs.existsSync(configPath)) {
-        raw = (0, types_1.asJsonObject)(yaml.load(fs.readFileSync(configPath, 'utf-8'))) ?? {};
-    }
-    const authSection = (0, types_1.asJsonObject)(raw.auth) ?? {};
-    raw.auth = { ...authSection, jwtSecret: secret };
-    const tmpPath = `${configPath}.tmp`;
-    try {
-        fs.mkdirSync(path.dirname(configPath), { recursive: true });
-        fs.writeFileSync(tmpPath, yaml.dump(raw, { lineWidth: 120, indent: 2, quotingType: '"' }), 'utf-8');
-        fs.renameSync(tmpPath, configPath);
-    }
-    catch (err) {
-        console.warn('[Phase1] Could not write auto-generated jwtSecret to config.yaml:', err);
-    }
-    return {
-        ...bootstrapConfig,
-        auth: { ...bootstrapConfig.auth, jwtSecret: secret },
-    };
-}
-// ---------------------------------------------------------------------------
 // setupInfra
 // ---------------------------------------------------------------------------
 /**
  * Phase 2: Create StorageLocationManager, ensure directories, configure TLS.
  * Returns the full InfraContext needed by subsequent boot phases.
  */
-async function setupInfra(configPath, bootstrapConfig) {
-    // Auto-generate jwtSecret if not set
-    const config = autoGenerateJwtSecret(configPath, bootstrapConfig);
+async function setupInfra(_configPath, bootstrapConfig) {
+    // No secret is generated here: the session signing key is the keychain's
+    // (local-auth loads or creates it once the keychain is up — D797).
+    const config = bootstrapConfig;
     const dataPath = path.resolve(config.server.dataPath);
     const port = config.server.port;
     const host = config.server.host;

package/dist/core/moleculer/moleculer.service.js

@@ -85,13 +85,6 @@ class MoleculerService {
      *    hub consumers share the same snapshot.
      */
     readinessRegistry;
-    /**
-     * Resolved cluster secret (`CAMSTACK_CLUSTER_SECRET` env, else
-     * `cluster.secret` config), or `undefined` when none is configured.
-     * Threaded both into the broker factory and the hub's
-     * `expectedClusterSecretHash` so `$hub.registerNode` can gate on it.
-     */
-    clusterSecret;
     /**
      * UDS server that listens for addon-runners spawned by this hub node.
      * `null` when the UDS server failed to start (children run broker-only).
@@ -193,13 +186,14 @@ class MoleculerService {
         // moleculer→eventemitter2 whose types are unresolvable at this
         // boundary, so the inference falls to `error` and trips
         // `no-unsafe-assignment`. Going via `unknown` documents the boundary.
-        this.clusterSecret =
-            process.env['CAMSTACK_CLUSTER_SECRET'] ?? this.config.get('cluster.secret');
+        // No cluster secret here (D797): the broker is created before the keychain
+        // can answer, and the Moleculer namespace was never authentication (TCP
+        // ignores it; UDP discovery broadcasts it in clear). The secret gates
+        // `$hub.registerNode`, read from the keychain at call time.
         const broker = (0, system_1.createBroker)({
             nodeID: 'hub',
             mode: 'hub',
             logLevel: this.config.get('moleculer.logLevel') ?? 'warn',
-            secret: this.clusterSecret,
             ...(tcpPort && !Number.isNaN(tcpPort) ? { tcpPort } : {}),
             ...(udpPort && !Number.isNaN(udpPort) ? { udpPort } : {}),
         });
@@ -274,9 +268,8 @@ class MoleculerService {
             onUnregisterNode: (nodeId) => {
                 this.removeNodeFromRegistry(nodeId);
             },
-            expectedClusterSecretHash: this.clusterSecret
-                ? (0, system_1.hashClusterSecret)(this.clusterSecret)
-                : undefined,
+            // System → Cluster, from the keychain (D797): off / on / unknown.
+            clusterSecretGate: system_1.getProcessClusterSecretGate,
         };
         const hubService = (0, system_1.createHubService)(hubDeps);
         this.brokerSafe.createService(hubService);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.483",
+  "version": "1.2.485",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.356",
-    "@camstack/addon-agent-ui": "1.2.193",
-    "@camstack/addon-auth": "1.2.132",
+    "@camstack/addon-admin-ui": "1.2.358",
+    "@camstack/addon-agent-ui": "1.2.194",
+    "@camstack/addon-auth": "1.2.133",
     "@camstack/addon-decoder-nodeav": "1.2.121",
     "@camstack/addon-notifiers": "1.2.128",
     "@camstack/addon-pipeline": "1.2.346",
     "@camstack/addon-pipeline-orchestrator": "1.2.298",
-    "@camstack/addon-post-analysis": "1.2.345",
-    "@camstack/sdk": "1.2.126",
-    "@camstack/system": "1.2.378",
-    "@camstack/types": "1.2.329",
-    "@camstack/ui-library": "1.2.251",
+    "@camstack/addon-post-analysis": "1.2.346",
+    "@camstack/sdk": "1.2.127",
+    "@camstack/system": "1.2.380",
+    "@camstack/types": "1.2.331",
+    "@camstack/ui-library": "1.2.252",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",